—
GO-2026-6201
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik
Quick fix
GO-2026-6201 — github.com/traefik/traefik/v2: upgrade to the fixed version with the command below.
go get github.com/traefik/traefik/v2@v2.11.53Details
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/traefik/traefik
Introduced in:
0No fixed version published yet for github.com/traefik/traefik (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/traefik/traefik/v2
Introduced in:
0Fixed in: 2.11.53Fix
go get github.com/traefik/traefik/v2@v2.11.53Go/github.com/traefik/traefik/v3
Introduced in:
0Fixed in: 3.6.24Fix
go get github.com/traefik/traefik/v3@v3.6.24References
- https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6[ADVISORY]
- https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7[FIX]
- https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0[FIX]
- https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce[FIX]
- https://github.com/traefik/traefik/pull/13542[FIX]
- https://github.com/traefik/traefik/pull/13543[FIX]
- https://github.com/traefik/traefik/pull/13556[FIX]
- https://github.com/traefik/traefik/releases/tag/v2.11.53[WEB]
- https://github.com/traefik/traefik/releases/tag/v3.6.24[WEB]
- https://github.com/traefik/traefik/releases/tag/v3.7.9[WEB]